fn parse_client_identity(der: &[u8]) -> (Option<String>, Vec<String>)
Extracts the subject CN and SAN DNS names from a DER-encoded certificate. Panic-free: any parse error yields (None, empty).
(None, empty)